topic Re: How to add hours to _time for specific events using eval? in Splunk Search https://community.splunk.com/t5/Splunk-Search/How-to-add-hours-to-time-for-specific-events-using-eval/m-p/217393#M63868 <P>worked perfect, thank you!</P> Wed, 09 Sep 2015 16:27:59 GMT kevinjacks 2015-09-09T16:27:59Z How to add hours to _time for specific events using eval? https://community.splunk.com/t5/Splunk-Search/How-to-add-hours-to-time-for-specific-events-using-eval/m-p/217391#M63866 <P>I need to add 3 hours to records which have SITE=1 and not change anything for other sites. </P> <P>I started with this, but I can't figure out how to incorporate that into an IF statement.</P> <PRE><CODE>| eval _time=_time+10800 </CODE></PRE> Wed, 09 Sep 2015 14:41:34 GMT https://community.splunk.com/t5/Splunk-Search/How-to-add-hours-to-time-for-specific-events-using-eval/m-p/217391#M63866 kevinjacks 2015-09-09T14:41:34Z Re: How to add hours to _time for specific events using eval? https://community.splunk.com/t5/Splunk-Search/How-to-add-hours-to-time-for-specific-events-using-eval/m-p/217392#M63867 <P>This should probably work:</P> <PRE><CODE>| eval _time=if(SITE==1, _time+10800, _time) </CODE></PRE> Wed, 09 Sep 2015 14:52:19 GMT https://community.splunk.com/t5/Splunk-Search/How-to-add-hours-to-time-for-specific-events-using-eval/m-p/217392#M63867 dkoops 2015-09-09T14:52:19Z Re: How to add hours to _time for specific events using eval? https://community.splunk.com/t5/Splunk-Search/How-to-add-hours-to-time-for-specific-events-using-eval/m-p/217393#M63868 <P>worked perfect, thank you!</P> Wed, 09 Sep 2015 16:27:59 GMT https://community.splunk.com/t5/Splunk-Search/How-to-add-hours-to-time-for-specific-events-using-eval/m-p/217393#M63868 kevinjacks 2015-09-09T16:27:59Z